The malicious changes were submitted by JiaT75, one of the two main xz Utils developers with years of contributions to the project.

“Given the activity over several weeks, the committer is either directly involved or there was some quite severe compromise of their system,” Freund wrote. “Unfortunately the latter looks like the less likely explanation, given they communicated on various lists about the ‘fixes’” provided in recent updates. Those updates and fixes can be found here, here, here, and here. arstechnica.com/…/backdoor-found-in-widely-used-l…

That really sucks. This kind of thing can make people and companies lose trust in open source.

No, its the exact opposite.

Supply chain conpromise is a level of risk to manage no unique to FOSS. Ever hear of sunburst? It resulted in a lot of Microsofts cloud customers getting wreaked all because their supply chain was compromised.

Do people continue to buy into 365 and Azure? Yes. Without care.

Yeah, I agree but I know some companies will have stupid thoughts like “a company employee is less likely to do that” or “at least we have an employment contract to back us up legally”.